Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War

Treasury also expands sanc­tions author­i­ties to include aero­space, marine, and elec­tron­ics sectors

WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) is con­tin­u­ing to impose severe costs on the Russian Federation for its unpro­voked and unjus­ti­fied war against Ukraine by tar­get­ing oper­a­tors in the Russian tech­nol­o­gy sec­tor to pre­vent it from evad­ing unprece­dent­ed mul­ti­lat­er­al sanc­tions and pro­cure crit­i­cal west­ern tech­nol­o­gy. OFAC is des­ig­nat­ing 21 enti­ties and 13 indi­vid­u­als as part of its crack­down on the Kremlin’s sanc­tions eva­sion net­works and tech­nol­o­gy com­pa­nies, which are instru­men­tal to the Russian Federation’s war machine. Treasury has also deter­mined that three new sec­tors of the Russian Federation econ­o­my are sub­ject to sanc­tions pur­suant to Executive Order 14024 (E.O. 14024). This allows Treasury impose sanc­tions on any indi­vid­ual or enti­ty deter­mined to oper­ate or have oper­at­ed in any of those sec­tors. Today’s sanc­tions are a part of the Administration’s com­pre­hen­sive response to Russia’s to restrict their access to resources, sec­tors of their econ­o­my that are essen­tial to sup­ply­ing and financ­ing the con­tin­ued inva­sion of Ukraine.

“Russia not only con­tin­ues to vio­late the sov­er­eign­ty of Ukraine with its unpro­voked aggres­sion but also has esca­lat­ed its attacks strik­ing civil­ians and pop­u­la­tion cen­ters,” said Secretary of the Treasury Janet L. Yellen. “We will con­tin­ue to tar­get Putin’s war machine with sanc­tions from every angle, until this sense­less war of choice is over.”

One of the tech­nol­o­gy com­pa­nies des­ig­nat­ed today exports more than 50 per­cent of Russian micro­elec­tron­ics and is Russia’s largest chip­mak­er. This fol­lows OFAC’s March 24 des­ig­na­tion of dozens of com­pa­nies in Russia’s defense-indus­tri­al base that are direct­ly sup­port­ing Putin’s unjus­ti­fied war against the peo­ple of Ukraine. Treasury took today’s action in close coor­di­na­tion with our part­ners who are sim­i­lar­ly com­mit­ted to ensur­ing the Russian Federation is not exploit­ing their juris­dic­tions for its destruc­tive aims.

Additionally, today OFAC is des­ig­nat­ing Russian gov­ern­ment mali­cious cyber actors. The United States will con­tin­ue to hold Putin’s cyber actors account­able for destruc­tive, dis­rup­tive or oth­er­wise desta­bi­liz­ing cyber activ­i­ty tar­get­ing the United States and its allies and partners.

Today’s actions demon­strate the U.S. government’s com­mit­ment to coun­ter­ing the eva­sion of sanc­tions that the United States and our allies and part­ners have put in place to impose unprece­dent­ed costs on the Russian Federation for its aggres­sion against Ukraine. The Treasury Department will use all author­i­ties at its dis­pos­al to enforce sanc­tions against the Russian gov­ern­ment and its proxies.

RUSSIAN SANCTIONS EVASION NETWORKS

Moscow-based OOO Serniya Engineering (Serniya) is at the cen­ter of a pro­cure­ment net­work engaged in pro­lif­er­a­tion activ­i­ties at the direc­tion of Russian Intelligence Services. This net­work oper­ates across mul­ti­ple coun­tries to obfus­cate the Russian mil­i­tary and intel­li­gence agency end-users that rely on crit­i­cal west­ern tech­nol­o­gy. Serniya and Moscow-based OOO Sertal (Sertal) work to illic­it­ly pro­cure dual-use equip­ment and tech­nol­o­gy for Russia’s defense sec­tor. Russia-based OOO Robin Treid, United Kingdom-based Majory LLP, United Kingdom-based Photon Pro LLP, and Spain-based Invention Bridge SL are front com­pa­nies uti­lized by Serniya to facil­i­tate its pro­cure­ment of key equip­ment for the Government of the Russian Federation (GoR). Within the past month, the European Union and Japan have placed export-relat­ed restric­tions on Serniya, Sertal, and Photon Pro. The UK is also tak­ing coor­di­nat­ed action on the com­pa­nies with­in its jurisdiction.

OFAC is des­ig­nat­ing Serniya, Sertal, Majory LLP, Photon Pro LLP, and OOO Robin Treid pur­suant to Executive Order (E.O.) 14024 for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, the GoR. OFAC is des­ig­nat­ing Invention Bridge SL pur­suant to E.O. 14024 for being owned or con­trolled by, or hav­ing act­ed or pur­port­ed to act for or on behalf of, direct­ly or indi­rect­ly, Serniya.

Singapore-based Alexsong Pte Ltd facil­i­tat­ed trans­ac­tions in sup­port of sanc­tions eva­sion by the Serniya net­work. OFAC is des­ig­nat­ing Alexsong Pte Ltd pur­suant to E.O. 14024 for being owned or con­trolled by, or hav­ing act­ed or pur­port­ed to act for or on behalf of, direct­ly or indi­rect­ly, the GoR.

To evade sanc­tions and car­ry out their pro­cure­ment of sen­si­tive tech­nol­o­gy, Serniya and Sertal employed a net­work of indi­vid­u­als to struc­ture trans­ac­tions and deceive coun­ter­par­ties. These indi­vid­u­als, who are being des­ig­nat­ed pur­suant to E.O. 14024 for hav­ing act­ed or pur­port­ed to act for or on behalf of, direct­ly or indi­rect­ly, Serniya, include Irina Viktorovna Nikolaeva, Yevgeniya Aleksandrovna Podgornova, Sergey Aleksandrovich Yershov, Anton Alekseevich Krugovov, Andrey Georgiyevich Zakharov, and Yevgeniy Aleksandrovich Grinin.

OFAC is also des­ig­nat­ing, pur­suant to E.O. 14024, Sergey Aleksandrovich Yershov and Viacheslav Yuryevich Dubrovinskiy for being lead­ers, offi­cials, senior exec­u­tive offi­cers, or mem­bers of the board of direc­tors of Serniya, an enti­ty whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to this order. Sergey Aleksandrovich Yershov is also being des­ig­nat­ed pur­suant to E.O. 14024 for hav­ing act­ed or pur­port­ed to act for or on behalf of, direct­ly or indi­rect­ly, Sertal a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024. Pursuant to E.O. 14024, OFAC is also des­ig­nat­ing Anton Alekseevich Krugovov for being a senior exec­u­tive offi­cer of Majory LLP, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024. Pursuant to E.O. 14024, OFAC is also des­ig­nat­ing Yevgeniy Aleksandrovich Grinin for being a leader, offi­cial, senior exec­u­tive offi­cer, or mem­ber of the board of direc­tors of Photon Pro LLP, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024.

OFAC is des­ig­nat­ing Tamara Aleksandrovna Topchi pur­suant to E.O. 14024 for being a leader, offi­cial, senior exec­u­tive offi­cer, or mem­ber of the board of direc­tors of Invention Bridge SL, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024.

OFAC is des­ig­nat­ing Russia-based OOO Nauchno-Tekhnicheskii Tsentr Metrotek and OOO Pamkin Khaus pur­suant to E.O. 14024 for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, Andrey Georgiyevich Zakharov, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024. OFAC is des­ig­nat­ing Russia-based OOO Foton Pro for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, Yevgeniy Aleksandrovich Grinin, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024.

Evgeniya Vladimirovna Bernova (Bernova), an asso­ciate of the Serniya net­work, oper­ates Malta-based Malberg Ltd (Malberg) though a multi­na­tion­al web of shell com­pa­nies. Malberg has worked to decep­tive­ly acquire dual-use equip­ment on behalf of Russian end-users. Bernova’s net­work includes Malberg’s Director, Nikita Aleksandrovich Sobolev, UK-based Djeco Group LP, Malta-based Djeco Group Holding Ltd, Malta-based Maltarent Ltd, and France-based SCI Griber. In addi­tion, Moscow-based Sernia-Film Co Ltd, where Bernova has served as a direc­tor, has facil­i­tat­ed the export of equip­ment by Malberg to intend­ed gov­ern­ment end-users in Russia.

OFAC is des­ig­nat­ing Malberg pur­suant to E.O. 14024 for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, the GoR. OFAC is des­ig­nat­ing Bernova for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, the GoR, Bernova and Nikita Aleksandrovich Sobolev for being lead­ers, offi­cials, senior exec­u­tive offi­cers, or mem­bers of the board of direc­tors of Malberg, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024. OFAC is des­ig­nat­ing Djeco Group LP, Djeco Group Holding, Maltarent Ltd, and SCI Griber for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, Bernova. OFAC is des­ig­nat­ing Sernia-Film Co Ltd for hav­ing mate­ri­al­ly assist­ed, spon­sored, or pro­vid­ed finan­cial, mate­r­i­al, or tech­no­log­i­cal sup­port for, or goods or ser­vices to or in sup­port of Malberg, a per­son whose prop­er­ty and inter­ests in prop­er­ty are blocked pur­suant to E.O. 14024.

Additionally, on September 23, 2020, Nikita Gennadievitch Kovalevskij (Kovalevskij) was des­ig­nat­ed by Treasury pur­suant to E.O. 13694, as amend­ed by E.O. 13757, for hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, Optima Freight OY (Optima). Optima is a Finland-based freight for­ward­ing com­pa­ny that was evad­ing U.S. sanc­tions by procur­ing under­wa­ter dive equip­ment for a com­pa­ny called Divetechnoservices (DTS). DTS was des­ig­nat­ed in 2018 pur­suant to E.O. 13694, as amend­ed by E.O. 13757, for procur­ing under­wa­ter equip­ment and div­ing sys­tems for the Russian Federal Security Service (FSB). In 2020, Kovalevskij reg­is­tered a new front com­pa­ny, Quantlog OY (Quantlog), in Finland in order to evade U.S. sanc­tions and con­tin­ue his illic­it pro­cure­ment activ­i­ties. Quantlog is being des­ig­nat­ed pur­suant to E.O. 13694, as amend­ed by E.O. 13757, for being owned or con­trolled by, or hav­ing act­ed or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, Kovalevskij.

RUSSIAN COMPANIES IN THE TECHNOLOGY SECTOR

As demon­strat­ed by the com­plex pro­cure­ment efforts ref­er­enced above, the Russian mil­i­tary is reliant on key Western tech­nolo­gies for its defense-indus­tri­al base to func­tion. In addi­tion to con­tin­u­ing to tar­get Russian sanc­tions eva­sion net­works, OFAC is also tar­get­ing key Russian tech­nol­o­gy com­pa­nies that are enabling Putin’s ille­gal war against Ukraine. These des­ig­na­tions will fur­ther impede Russia’s access to west­ern tech­nol­o­gy and the inter­na­tion­al finan­cial system.

AO NII-Vektor is a Saint Petersburg, Russia-based soft­ware and com­mu­ni­ca­tions tech­nol­o­gy com­pa­ny that has pro­duced tech­ni­cal analy­sis and reports in sup­port of the pro­duc­tion stage of Liana con­stel­la­tion satel­lites for the Russian Federation. Liana con­stel­la­tion is Electronic Intelligence (ELINT) capa­bil­i­ty which has like­ly been used to track ships, air­craft, and ground vehi­cles dur­ing Russian’s ille­gal inva­sion of Ukraine. AO NII-Vektor is being des­ig­nat­ed pur­suant to E.O. 14024 for oper­at­ing or hav­ing oper­at­ed in the tech­nol­o­gy sec­tor of the Russian Federation economy.

T‑Platforms is a Moscow, Russia-based com­pa­ny oper­at­ing in the com­put­er hard­ware sec­tor. T‑Platforms claims to be in the Russian super­com­put­er indus­try and the lead­ing domes­tic devel­op­er of orig­i­nal com­put­ing equip­ment for the mass infor­ma­tion tech­nol­o­gy mar­ket.  T Platforms was con­sid­ered the Russian high-per­for­mance com­put­ing activ­i­ty leader cir­ca 2012 and was tasked with imple­ment­ing a super­com­put­er cen­ter for the Russian defense indus­try. T Platforms is being des­ig­nat­ed pur­suant to E.O. 14024 for oper­at­ing or hav­ing oper­at­ed in the tech­nol­o­gy sec­tor of the Russian Federation economy.

Joint Stock Company Mikron (Mikron) is the largest Russian man­u­fac­tur­er and exporter of micro­elec­tron­ics. In fact, Mikron is respon­si­ble for export­ing more than 50 per­cent of Russian micro­elec­tron­ics. The com­pa­ny addi­tion­al­ly man­u­fac­tures inte­grat­ed cir­cuits, elec­tron­ic com­po­nents, and is Russia’s largest chip­mak­er. As one exam­ple of Mikron’s work, the com­pa­ny received tax ben­e­fits to pro­duce the domes­tic chip for Russia’s National Payment Card System, also known as Mir. The Mir pay­ment card sys­tem was devel­oped fol­low­ing pre­vi­ous sanc­tions on Russia. Mikron is being des­ig­nat­ed pur­suant to E.O. 14024 for oper­at­ing or hav­ing oper­at­ed in the tech­nol­o­gy sec­tor of the Russian Federation economy.

Molecular Electronics Research Institute (MERI) is a research insti­tute that man­u­fac­tures com­put­ers, search and nav­i­ga­tion equip­ment, and con­ducts research and devel­op­ment. Specifically, MERI con­ducts research and design work for var­i­ous fed­er­al agen­cies of the GoR. MERI is being des­ig­nat­ed pur­suant to E.O. 14024 for oper­at­ing or hav­ing oper­at­ed in the tech­nol­o­gy sec­tor of the Russian Federation economy.

TREASURY EXPANDS RUSSIA SANCTIONS AUTHORITIES

In addi­tion to the sanc­tions imposed on Russian actors today, Treasury is also enhanc­ing and expand­ing its Russia sanc­tions author­i­ties. Today, the Secretary of the Treasury, in con­sul­ta­tion with the Secretary of State, deter­mined that sanc­tions apply to the aero­space, marine, and elec­tron­ics sec­tors of the Russian Federation econ­o­my pur­suant to sec­tion 1(a)(i) of Executive Order (E.O.) 14024. This deter­mi­na­tion allows for sanc­tions to be imposed on any indi­vid­ual or enti­ty deter­mined to oper­ate or have oper­at­ed in any of those sec­tors and pro­vides an expand­ed abil­i­ty to swift­ly impose addi­tion­al eco­nom­ic costs on Russia for its war of choice in Ukraine. This action builds on pre­vi­ous deter­mi­na­tions with respect to the finan­cial ser­vices, tech­nol­o­gy, and defense and relat­ed materiel sec­tors of the Russian Federation econ­o­my. Today’s new­ly iden­ti­fied sec­tors align with recent actions tak­en by the U.S. Department of Commerce tar­get­ing these sec­tors, which are strate­gi­cal­ly impor­tant to Russia’s eco­nom­ic ambi­tions, long-term tech­no­log­i­cal devel­op­ment, and defense indus­tri­al base.

TSNIIKHM TRITON MALWARE HACKER AND LEADERSHIP

The State Research Center of the Russian Federation (FGUP) Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) was respon­si­ble for build­ing a cus­tomized tool that enabled the August 2017 cyber attack on a Middle East petro­chem­i­cal facil­i­ty. TsNIIKhM devel­oped the Triton mal­ware, also known as TRISIS and HatMan, specif­i­cal­ly to tar­get and manip­u­late ICS that are used in some crit­i­cal infra­struc­ture facil­i­ties. TsNIIKhM deployed the mal­ware through phish­ing that tar­get­ed the petro­chem­i­cal facil­i­ty. During the cyber attack, the facil­i­ty auto­mat­i­cal­ly shut down after sev­er­al of the ICS con­trollers entered into a failed state, pre­vent­ing the malware’s full func­tion­al­i­ty from being deployed.

OFAC des­ig­nat­ed TsNIIKhM on October 23, 2020, pur­suant to Section 224(a)(1)(A) of the Countering America’s Adversaries Through Sanctions Act (CAATSA) for know­ing­ly engag­ing in sig­nif­i­cant activ­i­ties under­min­ing cyber­se­cu­ri­ty against any per­son, includ­ing a demo­c­ra­t­ic insti­tu­tion, or gov­ern­ment on behalf of the Government of the Russian Federation.

Today, OFAC is tak­ing fur­ther action against key TsNIIKhM employ­ees who were present at the time of the attack. On March24, 2022, the Department of Justice unsealed the indict­ment of Evgeny Viktorovich Gladkikh (Gladkikh), who is an employ­ee in TsNIIKhM’s Applied Development Center (ADC). Gladkikh is involved in ICS and super­vi­so­ry con­trol and data acqui­si­tion (SCADA) research and has exten­sive expe­ri­ence work­ing net­work exploita­tion and pen­e­tra­tion testing.

Since at least 2017, ADC employ­ees, includ­ing Gladkikh, pre­pared, sup­port­ed, con­duct­ed, and con­spired to con­duct com­put­er intru­sions using ADC resources that tar­get­ed the ener­gy facil­i­ties in the United States and else­where. Gladkikh, along with oth­er TsNIIKhM and ADC employ­ees, played a cru­cial role in the August 2017 Triton mal­ware cyber-attack, specif­i­cal­ly tar­get­ing the petro­chem­i­cal facility’s safe­ty instru­ment­ed sys­tems, seek­ing to dis­rupt the facility’s cyber­se­cu­ri­ty sys­tems, as well as the facility’s dis­trib­uted con­trols sys­tems. Gladkikh’s mali­cious cyber actions result­ed in the facil­i­ty under­go­ing an emer­gency shut­down on at least two occasions.

Sergei Alekseevich Bobkov (Bobkov) is TsNIIKhM’s General Director, since at least October 2017. Konstantin Vasilyevich Malevanyy (Malevanyy) is TsNIIKhM’s Deputy General Director and has been a Chief of the ADC since at least January 2017. Bobkov and Malevanyy work direct­ly with mil­i­tary rep­re­sen­ta­tives of the Russian Ministry of Defense and oth­er Russian insti­tu­tions with ties to Russia’s defense sec­tor. Additionally, Malevenyy, has con­nec­tions with the Russian FSB through his roles at TsNIIKhM and the ADC.

Gladkikh, Bobkov, and Malevanyy are being des­ig­nat­ed pur­suant to Section 224(a)(1)(B) of CAATSA for act­ing or pur­port­ing to act for or on behalf of, direct­ly or indi­rect­ly, TsNIIKhM.

SANCTIONS IMPLICATIONS

As a result of today’s action, all prop­er­ty and inter­ests in prop­er­ty of the des­ig­nat­ed per­sons described above that are in the United States or in the pos­ses­sion or con­trol of U.S. per­sons are blocked and must be report­ed to OFAC. In addi­tion, any enti­ties that are owned, direct­ly or indi­rect­ly, indi­vid­u­al­ly or in the aggre­gate, 50 per­cent or more by one or more blocked per­sons are also blocked. Unless autho­rized by a gen­er­al or spe­cif­ic license issued by OFAC, or exempt, OFAC’s reg­u­la­tions gen­er­al­ly pro­hib­it all trans­ac­tions by U.S. per­sons or with­in (or tran­sit­ing) the United States that involve any prop­er­ty or inter­ests in prop­er­ty of des­ig­nat­ed or oth­er­wise blocked per­sons. In addi­tion, finan­cial insti­tu­tions and oth­er per­sons that engage in cer­tain trans­ac­tions or activ­i­ties with the sanc­tioned enti­ties and indi­vid­u­als may expose them­selves to sanc­tions or be sub­ject to an enforce­ment action. The pro­hi­bi­tions include the mak­ing of any con­tri­bu­tion or pro­vi­sion of funds, goods, or ser­vices by, to, or for the ben­e­fit of any blocked per­son, or the receipt of any con­tri­bu­tion or pro­vi­sion of funds, goods, or ser­vices from any such person.

Original source of arti­cle: home.treasury.gov